sources

Update metadata for an HEC token for a Splunk HEC Source

Update the metadata for the specified HEC token for the specified Splunk HEC Source.

patch/system/inputs/{id}/hectoken/{token}

Request

Base URL
/ (relative, and the document was published on a file host, not at the API’s origin)
Auth
- HTTP bearer
- or OAuth 2
  Client credentials
  Token URL: https://login.cribl.cloud/oauth/token

idstring required

The <code>id</code> of the Splunk HEC Source.

tokenstring required

The HEC token value whose metadata you want to update. Must match an existing token on the Source.

allowedIndexesAtTokenstring[]

List of index names that the HEC token is allowed to write to.

descriptionstring

Brief description for the HEC token.

enabledboolean

If <code>true</code>, the HEC token is enabled. Otherwise, <code>false</code>.

The updated Splunk HEC Source with the modified HEC token metadata.

countinteger required

Number of items returned in the items array.

Oct 18, 2026fd542bb248a2 Revision changes
- info
  added the non-success response with the status
- info
  added the non-success response with the status
Sep 12, 20263816b6fddba1 Revision changes
- info
  added the optional property // to the response with the status
- info
  added the optional property /// to the response with the status
- info
  added the optional property /// to the response with the status